c0dearm / sharks Goto Github PK

Update the README benchmarks table with results from running cargo bench in other targets

Zeroize is a trait to securely overwrite secrets that uses compiler intrinsics to prevent the overwrite to be optimized away. It is performant and portable.

It would be nice to add the zeroize(drop) on secret data(especially the share) so it is cleared from memory when dropped. This basically reduces a lot the lifetime of sensitive data in memory to protect against memory dumps.

If you want me to implement this, just leave it to me!

Add a GitHub action to check code coverage, to enforce contributors to write unit tests.

ahash has yanked it's versions that are used by the older versions of hashbrown used in this library.

Is it possible to upgrade hashbrown to a newer version?

Just fyi, there is some "upcoming" Adept Secret Sharing paper by Rogaway and Bellare, presumably it's a sequel to https://web.cs.ucdavis.edu/~rogaway/papers/rcss.pdf but..

I've only seen the talk so far, so not sure when it'll actually appear.

I think https://github.com/SpinResearch/RustySecrets expects to implement it whenever the paper gets released.

Would love seeing this crate working on the web!

I would like help from the community to run a serious security audit around this library and write issues about possible vulnerabilities

It seems having some threading concurrency could be beneficial, especially for large secrets, where it could be possible to compute multiple parallel Lagrange interpolation roots, one for each secret chunk.

Maybe in some other parts is also valuable, but it needs investigation.

Tasks:

• Investigate which parts of the code could benefit from concurrency
• Implement threading where necessary
• Implement unit tests for the threading
• Implement benchmark tests for the threading
• Check threading doesn't add much overhead for short secrets and that is very beneficial for large secrets
• Make the number of threads a configurable parameter, with default option "auto".